Splunk Search

finding percentage different between last week and week before?

abi2023
Path Finder

I have spl in splunk
index=demo 
search compliance= standard1 | timechart span=1week count by status 
| add totals row=t enable not_enable fieldname= "total"
| eval percentage = round((enable / total ) * 100 , 0) . " %"
| reverse 
| table _time percentage 

above spl show percentage week over week I want to show anther column show percentage different between last week and week before how do I show this next to last week row?
If week before is 56% percentage and last week percentage 70% it need show next last week row 14% 
how can I do this? I try join append it did not work for me.
Thanks in advance

Labels (3)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂

The two commands which let you "carry over" data from one row to another are autoregress and streamstats.

autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂

The two commands which let you "carry over" data from one row to another are autoregress and streamstats.

autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...

 

Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...